Versions Affected : All versions prior to TrueNAS Core 12.0-U8.1 To verify if a system isvulnerable, run afpd -v. Systems with a version string that is not 3.1.13 or newer are vulnerable.

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root.

CVSS

Base score

Workaround

No workarounds available

Mitigation

Disable affected AFP shares until upgrade is possible
Upgrade to TrueNAS 12.0-U8.1

Commit

TrueNAS Jira Ticket NAS-113284
TrueNAS CORE 12.0 Commit

Further information

MITRE CVE-2022-23121 Entry
NIST NVD Entry